Exam 1Y0-402 topic 1 question 46 discussion

and firewall1?

C. Port 443 outbound and Port 443 inbound 389/636 open on fw3

C for me, it's enought. LDAP based on picture need to be implemented on firewall 3 instead

D. https://docs.citrix.com/en-us/legacy-archive/downloads/netscaler-gateway-12-0.pdf page #388

Isn't the answer in the question? "All communication across DMZ 1, DMZ 2, and the Internal Network is encrypted over port 443" So it would be C?

Opening port 443 is enough when there is no authentication configured on Netscaler Gateway in the first DMZ. If you enabled authentication on NetScaler Gateway in the first DMZ, this appliance might need to connect to an authentication server in the internal network. If authentication is enabled additionel ports are needed. Example: 1812 for Radius or 389 for LDAP. https://docs.citrix.com/en-us/netscaler-gateway/12/double-hop-dmz/ng-double-dmz-install-con/ng-double-dmz-install-open-ports-tsk.html

C and D I think two answers are required.

Can someone confirm ... the need to open port 389 (LDAP) and/or 636 (LDAPS) LDAP/LDAPS verification can handles the authentication @Active Director The verification step can be delegated to Second NS GateWay, StoreFront or the Delivery Controller. https://support.citrix.com/article/CTX101810

443 = SSL 389 = LDAP 696 = LDAPS (Secure)